Port Forwarding

PanDoreS

Hi !

I've been trying to do a port forwarding on my multiples VPN servers, but i can't make it work :/

My server.conf :

port 443
proto udp
dev tun
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
reneg-sec 0
ca /etc/openvpn/easy-rsa/2.0/keys/ca.crt
cert /etc/openvpn/easy-rsa/2.0/keys/server.crt
key /etc/openvpn/easy-rsa/2.0/keys/server.key
dh /etc/openvpn/easy-rsa/2.0/keys/dh1024.pem
plugin /etc/openvpn/radiusplugin.so /etc/openvpn/radiusplugin.cnf
client-cert-not-required
username-as-common-name
server 10.8.0.0 255.255.255.0
push "redirect-gateway def1"
push "dhcp-option DNS 8.8.8.8"
push "dhcp-option DNS 8.8.4.4"
keepalive 5 30
comp-lzo
persist-key
persist-tun
status 1194.log
verb 3
client-config-dir /etc/openvpn/ccd
route 10.8.0.0 255.255.255.0

My client.conf :

client
dev tun
proto udp
remote xx.xx.xx.xx 443
resolv-retry infinite
nobind
tun-mtu 1500
tun-mtu-extra 32
mssfix 1450
persist-key
persist-tun
ca ca.crt
auth-user-pass
comp-lzo
reneg-sec 0
verb 3

I've put "client-config-dir /etc/openvpn/ccd" and "route 10.8.0.0 255.255.255.0" into my server.conf, and in my ccd folder i have a file name named "PanDoreS" which contains :

ifconfig-push 10.8.0.5 10.8.0.6

To redirect the port to my static ip i used this iptables rules :

iptables -t nat -A PREROUTING -p tcp -m tcp --dport 5689 -j DNAT --to-destination 10.8.0.5:5689

But all of this doesn't work :/ I can't connect to the port 5689 on my server, and i don't know if this is normal but on my SSH server terminal, i can't ping my static openvpn ip adress (maybe a subnet issue ?).

Do you guys know the problem on my configuration ? 🙂

Thanks by advance 😃 !

PanDoreS

I know it's the 443 port (which it used by HTTPS) but these servers don't have a web server on them, and the 443 port is unblocked by my school firewall 😉

I want to communicate to my server ip like "1.1.1.1:5689" and it redirect to my static local client ip "10.8.0.5:5689" and to the final client.
On another server I did that successfully but here, it doesn't work.

And this is the log 🙂

Fri Apr 25 14:27:54 2014 OpenVPN 2.2.2 x86_64-unknown-linux-gnu [SSL] [LZO2] [EPOLL] [PKCS11] [eurephia] built on Apr 5 2012
Fri Apr 25 14:27:54 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables
Fri Apr 25 14:27:54 2014 PLUGIN_INIT: POST /etc/openvpn/radiusplugin.so '[/etc/openvpn/radiusplugin.so] [/etc/openvpn/radiusplugin.cnf]' intercepted=PLUGIN_AUTH_USER_PASS_VERIFY|PLUGIN_CLIENT_CONNECT|PLUGIN_CLIENT_DISCONNECT
Fri Apr 25 14:27:54 2014 Diffie-Hellman initialized with 1024 bit key
Fri Apr 25 14:27:54 2014 WARNING: POTENTIALLY DANGEROUS OPTION --client-cert-not-required may accept clients which do not present a certificate
Fri Apr 25 14:27:54 2014 TLS-Auth MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Apr 25 14:27:54 2014 Socket Buffers: R=[124928->131072] S=[124928->131072]
Fri Apr 25 14:27:54 2014 ROUTE default_gateway=108.XX.XX.XX
Fri Apr 25 14:27:54 2014 TUN/TAP device tun0 opened
Fri Apr 25 14:27:54 2014 TUN/TAP TX queue length set to 100
Fri Apr 25 14:27:54 2014 /sbin/ip link set dev tun0 up mtu 1500
Fri Apr 25 14:27:54 2014 /sbin/ip addr add dev tun0 local 10.8.0.1 peer 10.8.0.2
Fri Apr 25 14:27:54 2014 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Fri Apr 25 14:27:54 2014 /sbin/ip route add 10.8.0.0/24 via 10.8.0.2
Fri Apr 25 14:27:54 2014 ERROR: Linux route add command failed: external program exited with error status: 2
Fri Apr 25 14:27:54 2014 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Fri Apr 25 14:27:54 2014 UDPv4 link local (bound): [undef]:443
Fri Apr 25 14:27:54 2014 UDPv4 link remote: [undef]
Fri Apr 25 14:27:54 2014 MULTI: multi_init called, r=256 v=256
Fri Apr 25 14:27:54 2014 IFCONFIG POOL: base=10.8.0.4 size=62
Fri Apr 25 14:27:54 2014 Initialization Sequence Completed
Fri Apr 25 14:28:09 2014 MULTI: multi_create_instance called
Fri Apr 25 14:28:09 2014 XX.XX.XXX.XX:65319 Re-using SSL/TLS context
Fri Apr 25 14:28:09 2014 XX.XX.XXX.XX:65319 LZO compression initialized
Fri Apr 25 14:28:09 2014 XX.XX.XXX.XX:65319 Control Channel MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0 EL:0 ]
Fri Apr 25 14:28:09 2014 XX.XX.XXX.XX:65319 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135 ET:32 EL:0 AF:3/1 ]
Fri Apr 25 14:28:09 2014 XX.XX.XXX.XX:65319 Local Options hash (VER=V4): '5b1533a2'
Fri Apr 25 14:28:09 2014 XX.XX.XXX.XX:65319 Expected Remote Options hash (VER=V4): 'd3a7571a'
Fri Apr 25 14:28:09 2014 XX.XX.XXX.XX:65319 TLS: Initial packet from XX.XX.XXX.XX:65319, sid=d6626575 8bcc40f1
Fri Apr 25 14:28:09 2014 XX.XX.XXX.XX:65319 PLUGIN_CALL: POST /etc/openvpn/radiusplugin.so/PLUGIN_AUTH_USER_PASS_VERIFY status=0
Fri Apr 25 14:28:09 2014 XX.XX.XXX.XX:65319 TLS: Username/Password authentication succeeded for username 'PanDoreS' [CN SET]
Fri Apr 25 14:28:09 2014 XX.XX.XXX.XX:65319 Data Channel Encrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Apr 25 14:28:09 2014 XX.XX.XXX.XX:65319 Data Channel Encrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Apr 25 14:28:09 2014 XX.XX.XXX.XX:65319 Data Channel Decrypt: Cipher 'BF-CBC' initialized with 128 bit key
Fri Apr 25 14:28:09 2014 XX.XX.XXX.XX:65319 Data Channel Decrypt: Using 160 bit message hash 'SHA1' for HMAC authentication
Fri Apr 25 14:28:09 2014 XX.XX.XXX.XX:65319 Control Channel: TLSv1, cipher TLSv1/SSLv3 DHE-RSA-AES256-SHA
Fri Apr 25 14:28:09 2014 XX.XX.XXX.XX:65319 [PanDoreS] Peer Connection Initiated with XX.XX.XXX.XX:65319
Fri Apr 25 14:28:09 2014 PanDoreS/XX.XX.XXX.XX:65319 OPTIONS IMPORT: reading client specific options from: /etc/openvpn/ccd/PanDoreS
Fri Apr 25 14:28:09 2014 PanDoreS/XX.XX.XXX.XX:65319 PLUGIN_CALL: POST /etc/openvpn/radiusplugin.so/PLUGIN_CLIENT_CONNECT status=0
Fri Apr 25 14:28:09 2014 PanDoreS/XX.XX.XXX.XX:65319 OPTIONS IMPORT: reading client specific options from: /tmp/openvpn_cc_a51706a9174e183013bd22ae46d039db.tmp
Fri Apr 25 14:28:09 2014 PanDoreS/XX.XX.XXX.XX:65319 MULTI: Learn: 10.8.0.5 -> PanDoreS/XX.XX.XXX.XX:65319
Fri Apr 25 14:28:09 2014 PanDoreS/XX.XX.XXX.XX:65319 MULTI: primary virtual IP for PanDoreS/XX.XX.XXX.XX:65319: 10.8.0.5
Fri Apr 25 14:28:11 2014 PanDoreS/XX.XX.XXX.XX:65319 PUSH: Received control message: 'PUSH_REQUEST'
Fri Apr 25 14:28:11 2014 PanDoreS/XX.XX.XXX.XX:65319 SENT CONTROL [PanDoreS]: 'PUSH_REPLY,redirect-gateway def1,dhcp-option DNS 8.8.8.8,dhcp-option DNS 8.8.4.4,route 10.8.0.1,topology net30,ping 5,ping-restart 30,ifconfig 10.8.0.5 10.8.0.6' (status=1)
Fri Apr 25 14:28:11 2014 PanDoreS/XX.XX.XXX.XX:65319 IPv6 in tun mode is not supported in OpenVPN 2.2
Fri Apr 25 14:28:35 2014 event_wait : Interrupted system call (code=4)
Fri Apr 25 14:28:35 2014 PLUGIN_CALL: POST /etc/openvpn/radiusplugin.so/PLUGIN_CLIENT_DISCONNECT status=0
Fri Apr 25 14:28:35 2014 TCP/UDP: Closing socket
Fri Apr 25 14:28:35 2014 /sbin/ip route del 10.8.0.0/24
Fri Apr 25 14:28:35 2014 Closing TUN/TAP interface
Fri Apr 25 14:28:35 2014 /sbin/ip addr del dev tun0 local 10.8.0.1 peer 10.8.0.2
Fri Apr 25 14:28:35 2014 PLUGIN_CLOSE: /etc/openvpn/radiusplugin.so
Fri Apr 25 14:28:35 2014 SIGINT[hard,] received, process exiting

Thanks man 😃 !

Edit : Oh maybe it's the

Fri Apr 25 14:27:54 2014 ERROR: Linux route add command failed: external program exited with error status: 2"

PanDoreS

Hi 🙂
Anyone have ideas for this ? 🙁

Thanks